feat(pair-corpus-honesty): LLM-generated Real-Vuln repos and unlicensed agent fixes as pointer pairs

Task 8.4 (Req 10.6, 5.1).

- harvest.merge_recipes appends recipes by name and never rewrites
  existing rows.
- vibe-py/build_recipes.py --pointers: the 40 LLM-generated repositories
  without a license become vendored = false rows (80 pairs, agent,
  seeded) appended to recipes.toml; unlicensed human repos stay skipped.
- agent-vfc/build_recipes.py --from ... --pointers [--cache]: unlicensed
  agent-authored fixes become title-tier pointer rows whose function
  label is derived from the cached excerpt (30 added from a fresh
  662-candidate search); TOML booleans rendered correctly.
- catalogs regenerated: vibe-py 115 rows (35 vendored + 80 pointer),
  agent-vfc 59 (29 + 30); no excerpt is vendored for any pointer row.
- `pairs --slice vibe-py --pointers` scores both provenances (human 35,
  agent 80); the default run skips 80 pairs with pointer_pair_skipped;
  suite and gates unchanged. README/docs name the nightly command.

Co-Authored-By: Claude Fable 5.1 <[email protected]>
Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG

benchmarks/pairs/README.md

@@ -69,6 +69,9 @@ and `reviewed` pairs, so `advisory` and `title` pairs never gate the improve loo
 
 ## Pointer pairs (not vendored)
 
+Current pointer rows: vibe-py 80 (the 40 LLM-generated Real-Vuln repositories, `agent`,
+`seeded`) and agent-vfc (unlicensed agent-authored fixes, `title`).
+
 A row with `vendored = false` carries its harvest recipe (`repo`, `parent`, `commit`,
 `path`, `mode`, `line`/`fix_path`/`fix_line`, ...) and no excerpt files (Req 10). The
 repository never redistributes that code: `pairs --pointers` (or